XSS攻击通用工具类

预防XSS攻击通用工具类CV即可。import java.util.regex.Matcher; import java.util.regex.Pattern; public class XssUtils { private static Pattern[] patterns new Pattern[]{ // Script fragments Pattern.compile(script(.*?)/script, Pattern.CASE_INSENSITIVE), // src... Pattern.compile(src[\r\n]*[\r\n]*\\\(.*?)\\\, Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL), Pattern.compile(src[\r\n]*[\r\n]*\\\(.*?)\\\, Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL), // lonely script tags Pattern.compile(/script, Pattern.CASE_INSENSITIVE), Pattern.compile(script(.*?), Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL), // eval(...) Pattern.compile(eval\\((.*?)\\), Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL), // expression(...) Pattern.compile(expression\\((.*?)\\), Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL), // javascript:... Pattern.compile(javascript:, Pattern.CASE_INSENSITIVE), // vbscript:... Pattern.compile(vbscript:, Pattern.CASE_INSENSITIVE), // onload(...)... Pattern.compile(onload(.*?), Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL), // alert Pattern.compile(alert(.*?), Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL), Pattern.compile(, Pattern.MULTILINE | Pattern.DOTALL), Pattern.compile(, Pattern.MULTILINE | Pattern.DOTALL), //Checks any html tags i.e. script, embed, object etc. Pattern.compile(((script|iframe|embed|frame|frameset|object|img|applet|body|html|style|layer|link|ilayer|meta|bgsound))), Pattern.compile(prompt) }; /** * xss替换函数 * * param value 需要替换的字符 * return 替换后的字符 */ public static String stripXSS(String value) { if (value ! null) { // Avoid null characters value value.replaceAll(\0, ); // Remove all sections that match a pattern for (Pattern scriptPattern : patterns) { value scriptPattern.matcher(value).replaceAll(); } } return value; } /** * xss校验函数 * * param value 需要校验的字符 * return 返回值true 表示存在xss漏洞false不存在 */ public static boolean checkIsXSS(String value) { boolean isXss false; if (value ! null) { for (Pattern scriptPattern : patterns) { Matcher matcher scriptPattern.matcher(value); if (matcher.find()) { isXss true; break; } } } return isXss; } }